Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
opensearch verison is 1.2.3
I am using filebeat 7.10.2 to create index template
I met the error
> Exiting: error loading template: could not load template. Elasticsearch returned: couldn't load template: 400 Bad Request: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]"}},"status":400}. Response body: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text},...
there is a “default” field under mapping, I don’t know why it was generated, and seems due to the default filebeat can’t setup index template
Describe the issue:
Configuration:
Relevant Logs or Screenshots: